Maritime Security
Responses to Questions for the Record Gao ID: GAO-11-140R October 22, 2010On July 21, 2010, we testified to Congress on the Department of Homeland Security's (DHS) progress and challenges in key areas of port security. Members of the committee requested that we provide additional comments to a number of post hearing questions. The responses are based on work associated with previously issued GAO products and also include selected updates--conducted in September 2010--to the information provided in these products.
GAO-11-140R, Maritime Security: Responses to Questions for the Record
This is the accessible text file for GAO report number GAO-11-140R
entitled 'Maritime Security: Responses to Questions for the Record'
which was released on November 22, 2010.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as
part of a longer term project to improve GAO products' accessibility.
Every attempt has been made to maintain the structural and data
integrity of the original printed product. Accessibility features,
such as text descriptions of tables, consecutively numbered footnotes
placed at the end of the file, and the text of agency comment letters,
are provided but may not exactly duplicate the presentation or format
of the printed version. The portable document format (PDF) file is an
exact electronic replica of the printed version. We welcome your
feedback. Please E-mail your comments regarding the contents or
accessibility features of this document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
GAO-11-140R:
United States Government Accountability Office:
Washington, DC 20548:
October 22, 2010:
The Honorable John D. Rockefeller IV:
Chairman:
The Honorable Kay Bailey Hutchison:
Ranking Member:
Committee on Commerce, Science, and Transportation:
United States Senate:
Subject: Maritime Security: Responses to Questions for the Record:
On July 21, 2010, we testified before your committee on the Department
of Homeland Security's (DHS) progress and challenges in key areas of
port security.[Footnote 1] Members of the committee requested that we
provide additional comments to a number of post hearing questions. The
questions and our answers are provided in the Enclosure 1. The
responses are based on work associated with previously issued GAO
products and also include selected updates--conducted in September
2010--to the information provided in these products. We conducted this
work in accordance with generally accepted government auditing
standards. To ensure the technical accuracy of the updated information
obtained in September 2010, we provided of copy of the information
contained in this letter to DHS. DHS provided technical comments that
we incorporated as appropriate.
As agreed with your offices, unless you publicly announce the contents
of this report earlier, we plan no further distribution until 30 days
from the date of this letter. At that time, this letter will be
available at no charge on the GAO Web site at [hyperlink,
http://www.gao.gov].
If you have any questions about this letter or need additional
information, please contact me at (202) 512-9610 or caldwells@gao.gov.
Contact points for our Offices of Congressional Relations and Public
Affairs may be found on the last page of this letter. Key contributors
to this letter are listed in Enclosure 2.
Signed by:
Stephen L. Caldwell:
Director:
Homeland Security and Justice:
Enclosures:
[End of section]
Enclosure 1: GAO Responses to Questions for the Record:
Small Vessel Threats and Strategy:
Question from Chairman Rockefeller:
1. Pending the release of the implementation plan for the DHS Small
Vessel Security Strategy, what are the potential options for
mitigating threats from small vessels? To what extent would a new
requirement that small vessels carry transponders--so they could be
tracked--be a viable solution? How does this option compare to
increased "neighborhood watch" type programs to encourage watermen and
pleasure boaters to report suspicious activity?
Please see question 2 below for a joint response.
Question from Senator Hutchison:
2. Since the terrorist attacks of September 11, 2001, maritime
security efforts have focused primarily on large commercial vessels,
cargoes, and crew. Efforts to address the small vessel environment
have largely been limited to traditional safety and basic law
enforcement concerns. Small vessels are, however, readily available
for potential exploitation by terrorists, smugglers of weapons of mass
destruction (WMDs), narcotics, aliens, other contraband, and other
criminals. Small vessels have also been successfully employed overseas
by terrorists to deliver Waterborne Improvised Explosive Devices
(WBIEDs). GAO previously noted that technology systems used by the
Coast Guard to track small vessels have not worked properly at night
or during inclement weather. In your view, is it cost-effective to
track small vessels?
Governmental agencies, both in the United States and abroad, have
exercised several options to address the risks presented by small
vessels. As we previously reported in April 2010,[Footnote 2] the
Department of Homeland Security (DHS)--including the U.S. Coast Guard
and U.S. Customs and Border Protection (CBP)--and other entities are
taking actions to reduce the risk from small vessels. These actions
include the development of the Small Vessel Security Strategy,
[Footnote 3] community outreach efforts through the America's Waterway
Watch (AWW) program and Operation Focused Lens, port-level vessel
tracking efforts with radars and cameras, port-scale nuclear detection
pilot projects, establishment of security zones in U.S. ports and
waterways, and escorts of possible targets of waterborne improvised
explosive devices. CBP and the Coast Guard also have other efforts
under way to prevent small vessels from transporting weapons of mass
destruction, terrorists, or narcotics from foreign countries into the
United States. CBP's Office of Air and Marine reports that it is using
airborne assets such as four engine P3 Airborne Early Warning and Long
Range Tracker aircraft and soon maritime reconnaissance versions of
unmanned Predator drones, to detect smugglers' vessels, including
semisubmersibles, sailing to the United States. The Coast Guard and
CBP's Office of Air and Marine also report that they station patrol
vessels along smuggling routes to intercept smugglers' vessels before
they reach U.S. shores. At the request of Chairman Bennie Thompson and
Ranking Member Peter King of the Committee on Homeland Security, House
of Representatives, we are currently reviewing CBP's Office of Air and
Marine program and examining the agency's use of its resources and
expect to issue the results of this review next year. Outside of the
United States, the government of Singapore began a program in 2007
called Harbour Craft Transponder System where all vessels not covered
by the International Maritime Organization's (IMO) International
Convention for the Safety of Life at Sea (generally, this convention
covers vessels 300 gross tons or more on an international voyage and
cargo ships of 500 gross tons or more) were required to install and
operate transponders that broadcast their position. The program was
implemented jointly by the Maritime and Port Authority, the Police
Coast Guard and the Republic of Singapore Navy, and an estimated 2,800
small vessels were equipped when its operation commenced in 2007. User
costs include the transponder device, which ranges in cost from
approximately $700 to $730 plus applicable taxes, depending on whether
the model is portable or fixed, and an annual operating cost of
approximately $90.
As we reported in March 2009, the expansion of vessel tracking to all
small vessels--through transponders or other methods--may be of
limited utility because of the large number of small vessels, the
difficulty identifying threatening actions, the challenges associated
with getting resources on scene in time to prevent an attack once it
has been identified, and the limitations of certain equipment.
[Footnote 4] For vessels not required to carry automatic
identification system (AIS)[Footnote 5] equipment, cameras may be
utilized, though not all ports have cameras suited to overcome
challenges posed by low lighting during operation at night or in bad
weather. Even when vessels carrying transponders are tracked in ports,
recognizing hostile intent is very difficult. During our reviews of
maritime security efforts, we were provided evidence of vessels
intruding into security zones where unauthorized access was
prohibited. While no attacks occurred, such vessels were able to
travel freely near potential targets. Coast Guard officials have told
us that their ability to enforce security zones is constrained by
their limited resources. Moreover, the Coast Guard has not been able
to meet its own internal standards for the frequency of escorts of
potential target vessels. The difficulty in recognizing potentially
threatening activity and the limited response capability indicates
that expanding tracking to all small vessels would not necessarily
diminish the risk posed by small vessels. While such tracking would
likely lead to increased observation of prohibited activities, such as
intrusion into security zones, it would not necessarily help to
differentiate between vessels that entered security zones with hostile
intent and vessels that entered for other reasons, such as better
fishing. In addition, with the increased number of vessels to observe,
watch standers could be overwhelmed by the amount of information they
must track or monitor. While the Coast Guard has research underway to
automate its ability to detect threatening behavior by vessels, even
if these efforts are successful they would not improve the agency's
ability to respond quickly. DHS's Small Vessel Security Strategy also
states that small-vessel risk reduction efforts should not impede the
lawful use of the maritime domain or the free flow of legitimate
commerce--making the need to decipher vessel behavior essential. As
the strategy states, given the size and complexity of the maritime
domain, risk-based decision making is the only feasible approach to
prevention, protection, response and recovery related to small-vessel
threats.
Much of the seaborne smuggling of narcotics and undocumented migrants
into the United States currently makes use of small vessels, such as
high-speed "go fast" boats and semisubmersibles. While CBP and the
Coast Guard are also taking actions to intercept smugglers at sea,
their ability to prevent this smuggling is mixed. In its fiscal year
2009 performance report, the Coast Guard reported removing 15 percent
of the cocaine being transported on noncommercial vessels bound for
the United States in fiscal year 2009. Conversely, the Coast Guard
reported that it interdicted approximately 84 percent of undocumented
migrants who attempted to enter the United States via maritime routes
in fiscal year 2009. CBP's performance report did not include similar
measures for maritime narcotic or migrant interdiction.
With the critical task of mitigating the risk posed by small vessels
before the Coast Guard and CBP, we believe a risk management approach
coupled with strong intelligence-gathering efforts would lead to the
greatest benefit. Intelligence-gathering efforts at the port level,
such as AWW, should help uncover potential threats before they develop
into full-fledged attacks. The program's outreach to over 400 local
watch group members in and around the Puget Sound region for the
Vancouver 2010 Winter Olympics demonstrated its potential as means of
increasing vigilance and communication. Moreover, targeted efforts
aimed at protecting critical infrastructure and valuable vessels,
along with random escorts and patrols, should help provide deterrence
against a small vessel attack inside U.S. port areas. Offshore,
intelligence efforts aimed at uncovering smuggling operations should
also help to target patrols and interceptions. These efforts would
include random patrols, which add uncertainty to where these assets
will be at any one time. A risk management approach that focuses
limited resources on the greatest risks is even more critical given
the federal government's current budget climate.
Security in Overseas Ports:
Questions from Chairman Rockefeller:
3. Regarding security in foreign ports, your statement emphasized the
importance of risk management and indicated that your work had shown
potential to apply more risk management to the Coast Guard inspection
of foreign ports. What did your work specifically show and how could
the Coast Guard use risk management more effectively? Can the Coast
Guard do this on its own, or would legislative changes be needed to
implement changes in the frequency or intensity of visits to foreign
ports?
Since we issued our report on the Coast Guard's International Port
Security Program in April 2008, the Coast Guard has adopted a new risk
management program.[Footnote 6] In April 2008, the Coast Guard was
just beginning the next phase of the program, revisiting countries to
reassess the security measures of 138 trading partners. As part of
this next phase, the Coast Guard planned to place greater emphasis on
countries that were not in compliance or that were struggling to
comply with International Ship and Port Facility Security (ISPS) Code
requirements. To accomplish this with available resources, the Coast
Guard planned to prioritize its country visits and capacity-building
efforts using a risk-based approach that would allow Coast Guard
officials to spend more time in countries not in compliance and whose
lack of compliance poses a higher risk to the United States. At the
time of our report, the Coast Guard was in the process of developing
this risk-management approach and had created working groups to
consider how to implement this approach. Since the issuance of our
report, the Coast Guard reported that the program finalized its
methodology which analyzes the risk a country potentially poses to the
United States, how well a country is implementing the ISPS Code, and
the likelihood that capacity-building efforts in the country would be
effective considering a variety of political, economic, and social
preconditions. According to the Coast Guard, the results of the
methodology are used to manage risk and limited resources by helping
establish assessment team size, determining countries and ports where
capacity-building resources would be most effective, and finally
identifying high-risk countries that need additional oversight. We
have not conducted a detailed review of this methodology or the Coast
Guard's implementation of it.
Although we have not analyzed or directly reported on this issue as it
relates to the Coast Guard, another approach the Coast Guard could
consider to incorporate risk management into the program is to use
mutual recognition arrangements with other countries, similar to that
developed by CBP for international customs. We reported in August 2008
that CBP worked with the international customs community to achieve a
system of mutual recognition--an arrangement whereby the actions or
decisions taken by one customs administration are recognized and
accepted by another administration.[Footnote 7] For a system of mutual
recognition to work, however, there must be an agreed-upon common set
of standards that are applied uniformly so that a level of confidence
exists between countries. As international standards exist for
maritime security through the ISPS Code, the Coast Guard could
consider developing a similar system of mutual recognition for
international maritime security. For example, the European Union has
developed detailed regulations for the consistent implementation of
the ISPS Code by its member states and established a process for
verifying the effectiveness of its member states' maritime security
measures. This process includes an inspection of member states' ports
that results in a report identifying any nonconformities with the
regulations and making recommendations to address the nonconformities.
Should the Coast Guard develop confidence in the European Union's
regulatory and inspection approach to determine whether its members
have fully implemented and maintain international maritime security
standards, under a mutual recognition arrangement with the European
Union the Coast Guard could agree to recognize and accept one
another's security practices. The Coast Guard could then give
countries with which it has such agreements lower priority for a
country visit. During a meeting in September 2010 to follow-up on our
report, Coast Guard officials told us that more flexibility to
determine whether an assessment is necessary for countries with which
there is confidence in the implementation of international maritime
security standards would be helpful to the program in allocating
program resources toward the highest-risk countries. Changes to
increase the frequency of visits to foreign ports would not require a
legislative change, whereas a decrease in frequency may require a
legislative change.
In regard to the Coast Guard's ability to spend more time in countries
not in compliance to assist with capacity building, we reported in
April 2008 that the International Port Security Program was subject to
limitations on its ability to offer capacity-building assistance
outside of assessment activities or to other countries that may comply
with the ISPS Code standard, but struggle to maintain their
compliance. Coast Guard officials stated that while authorities
allowed for certain types of capacity-building activities, several of
the authorities limited those activities to ports in foreign countries
that have been found to lack effective antiterrorism measures.
However, with the enactment of the Coast Guard Authorization Act of
2010,[Footnote 8] the Coast Guard has new authorities to provide
assistance to what the Coast Guard describes as a broader range of
countries. For example, the act authorizes the Coast Guard to provide
specified types of assistance to foreign ports based on risk
assessments and comprehensive port security assessments rather than a
finding of the lack of effective antiterrorism measures before
providing assistance. In terms of changes to the frequency of visits
to foreign ports, although the Security and Accountability For Every
Port Act of 2006 (SAFE Port Act) currently requires that a minimum
number of reassessments of the effectiveness of antiterrorism measures
in foreign ports be conducted at a rate of not less than once every 3
years,[Footnote 9] the International Port Security Program strives to
conduct reassessments every 2 years to follow the direction contained
in the conference report accompanying the fiscal year 2007 DHS
Appropriations Act.[Footnote 10] The Coast Guard states that in
addition to the reassessments, it visits all countries at least
annually, with countries that have ports with nonconformance issues it
has identified more frequently. Consequently, to decrease the
frequency of visits to an amount less than the established frequencies
in the SAFE Port Act would require legislative changes whereas an
increase in frequency would not require legislative changes.
$. S. 3639 authorizes the Coast Guard to provide assistance to foreign
governments or ports to enhance their maritime security. Does GAO
support this provision?
The provisions in S. 3639 to authorize the Coast Guard to provide
assistance to foreign governments or ports to enhance their maritime
security are similar to provisions recently enacted in the Coast Guard
Authorization Act of 2010. While we have not directly looked at this
issue, based on our work, Coast Guard technical assistance to other
countries could be another way to improve port security in certain
circumstances with available Coast Guard resources. During our review
of the International Port Security Program, Coast Guard officials told
us that funding is a major challenge for most countries struggling to
meet and sustain ISPS Code requirements.[Footnote 11] For example,
Coast Guard officials stated that in several African countries, the
designated authority within the government does not have the resources
to provide security for ports or funds to provide grants for ports in
need of improvements. However, according to Coast Guard officials, the
Coast Guard also does not have resources to supply physical security
assets, such as fences and guards, to those countries that cannot
afford them. Program officials have sought to raise awareness about
low-cost methods that can be used to meet certain international
security requirements, such as the use of "tabletop" exercises rather
than conducting full-scale drills and exercises.
In addition to the budgetary limitations, Coast Guard officials stated
that the program faced legal limitations in the capacity-building
efforts they could provide under their previous legislative
authorities. As discussed above, while previous authorities allowed
for certain types of capacity-building activities, several of those
authorities limited those activities to ports in foreign countries
that had been found to lack effective antiterrorism measures. However,
with the enactment of the Coast Guard Authorization Act of 2010, the
Coast Guard has new authorities to provide assistance. For example,
the act authorizes the Coast Guard to provide assistance based on risk
assessments and comprehensive port security assessments rather than a
finding of a lack of effective antiterrorism measures. Another
capacity-building authority authorizes the provision of technical
assistance when it is provided in conjunction with regular Coast Guard
operations. The Coast Guard Authorization Act of 2010 amended this
authority to expressly authorize the use of funds for certain purposes
such as the activities of traveling contact teams, including any
transportation expense, translation services, seminars, and
conferences involving members of maritime authorities of foreign
governments, and the distribution of publications pertinent to
engagement with maritime authorities of foreign governments.
5. Does the Coast Guard have an adequate workforce of inspectors who
can operate in foreign environments to inspect foreign ports? To what
extent would that workforce be affected by proposals to change the
frequency or intensity of visits to foreign ports? How would it be
affected by proposals to increase technical assistance to foreign
governments and ports outside of the normal visit/inspection cycle?
We reported in January 2010 that during this decade, the Coast Guard
has been challenged with expanded mission responsibilities, and
concerns have been raised about whether the Coast Guard has a
sufficient workforce to fulfill these mission responsibilities.
[Footnote 12] The impact of expanding missions underscored
shortcomings in the Coast Guard's ability to effectively allocate
resources, such as personnel; ensure readiness levels; and maintain
mission competency. Similarly, when we concluded our review of the
International Port Security Program in April 2008, we reported that
the Coast Guard also faced challenges in ensuring that it had trained
staff available to meet assessment and assistance needs. According to
Coast Guard officials, personnel working in the program have unique
demands placed on their skills since they must be proficient security
inspectors and must also be culturally and diplomatically sensitive
liaisons to foreign countries. The challenge was made more difficult
by Coast Guard plans to compress its schedule for completing follow-up
visits so that all were to be completed within a 2-year time frame and
by the Coast Guard personnel rotation policy that moves personnel
between different positions every 3 to 4 years.
We also reported that the Coast Guard did not have a fully developed
strategic workforce plan for the program. Coast Guard officials noted
that the calculations for the number of program personnel required
were straightforward as the number of countries to assess was limited
to approximately 138 and the amount of time required to conduct
assessments was known. When we asked Coast Guard officials about
ensuring the availability of sufficient resources for the next phase
of the program, Coast Guard officials stated that they believed they
had sufficient resources to conduct assessments and provide capacity
building within the current authorities provided to the program.
However, we reported that they had not completed aspects of workforce
planning, such as processes to regularly analyze staffing data and
workforce demographics and develop strategies for identifying and
filling gaps, as human capital management guidance provided by the
Office of Personnel Management suggests. Without such planning, we
reported that it may be difficult for the Coast Guard to meet its
program goals. As a result, we recommended that the Coast Guard
develop and incorporate a workforce plan as part of the risk
management approach it was developing to prioritize the performance of
program activities. DHS and the Coast Guard concurred in part with our
recommendation. Specifically, they noted that the Coast Guard has
analyzed its workforce needs to carry out the functions currently
mandated and had begun to develop a methodology to determine where
best to conduct capacity-building efforts. They stated that more
analysis would be done when and if authorities are provided to expand
the capacity-building activities of the program. While we agreed that
the Coast Guard would need additional authorities to carry out certain
capacity-building activities beyond countries not in compliance, the
Coast Guard's workforce planning efforts were not consistent with
those called for by human capital management guidance, even for the
program's current authorities.
While we do not have the data or information to determine how the
Coast Guard's workforce would be affected by potential changes to the
frequency or intensity of visits, or changes to increase the technical
assistance to foreign governments and ports, since the issuance of our
report the Coast Guard has reported taking additional actions to more
fully develop a workforce plan for the program. Although the program
does not envision a separate "stand-alone" plan, the Coast Guard
reported reviewing human capital management guidance and is
incorporating some of the principles in its program management. Among
other things, the Coast Guard reported that the program continues to
refine its human capital management including using an analysis to
identify training needs for new personnel entering the program and
promulgation of guidance on resources that should be devoted to
conducting assessment visits for various categories of countries. The
program also reported finalizing its methodology which looks at the
risk a country potentially poses; how well it is implementing the
international security standard, the ISPS Code; and the likelihood
that the capacity-building efforts in the country would be effective.
While we have not assessed these actions, we believe they contribute
towards the implementation of our recommendation and thereby better
position the Coast Guard to ensure that it has an adequate workforce.
Should the program be given additional capacity-building authority,
the Coast Guard stated that the program will use its methodology to
identify additional personnel needs and where they should best be
stationed.
Question from Senator Klobuchar:
6. As recently as this month, the U.S. Coast Guard estimated that as
many as 15 countries are not maintaining effective antiterrorism
measures at their port facilities. If foreign ports or facilities fail
to maintain these measures, the Coast Guard has the authority to deny
entry to vessels arriving from such ports or impose specific
conditions on the vessels in order to be allowed entry to the U.S. Can
you tell us more about this assessment and what the conditions on the
ground are at these ports? How are we working with foreign governments
to increase protective measures at their ports? What steps are we
taking to address the national sovereignty concerns of nations whose
ports are being examined under the International Port Security Program?
There are a variety of reasons and circumstances whereby the Coast
Guard deems a country and its ports as not in compliance with
international port security standards. In regards to the conditions in
countries currently considered not to be maintaining effective
antiterrorism measures at their port facilities, the Coast Guard
considers this information as sensitive and it therefore cannot be
publicly released. However, the Coast Guard told us that its concerns
about these countries generally center around the failure of the
contracting government to audit the ISPS Code compliance of its port
facilities and on the individual port facilities' failure to
adequately control access of personnel and cargo. During the
assessment the Coast Guard conducts of foreign ports[Footnote 13]
through its International Port Security Program, Coast Guard officials
visit and review the implementation of security measures in foreign
ports, examining the physical security measures and access controls at
the ports as well as the policies, procedures, and training related to
the ISPS Code. Based on its visit and the information provided by the
foreign country, the Coast Guard team determines the extent to which
the country has substantially implemented the ISPS Code. The Coast
Guard team makes a determination that a country has "substantially
implemented" the ISPS Code if the team concludes that effective
security measures are in place at the ports that meet the requirements
of the ISPS Code and the government exercises effective oversight. If
the team does not observe these items, the team makes a determination
that the country "has not substantially implemented" the ISPS Code. In
addition to being an outcome of a country visit, the Coast Guard may
also find a country to not have substantially implemented the ISPS
Code if it denies access to its ports, it fails to communicate
information on its compliance to the Coast Guard or the IMO, or a
credible report by another U.S. government agency or other source
finds that substantial security concerns exist.
In cases where a country has been found not to have substantially
implemented the ISPS Code, the Coast Guard explains the identified
deficiencies and makes recommendations to the country for addressing
the deficiencies and provides possible points of contact for
assistance to help the country improve. In addition, Coast Guard
officials work with the appropriate American embassy to identify other
capacity-building resources that might assist the country. As part of
the program, the Coast Guard has been collecting and sharing best
practices it has observed during its visits with a special emphasis on
low-cost security practices or innovative applications that are easy
to implement and do not require a significant financial investment.
The Coast Guard shares these best practices with other countries and
makes them publicly available through the program's Web site to assist
foreign governments in making improvements in their port security. The
Coast Guard team then revisits the country to observe whether
identified deficiencies have been addressed. Depending on the progress
observed and the cooperation received from the country, the team may
decide to continue to work with the country and make a revisit or
place conditions on vessels that try to enter U.S. ports after
visiting the country's ports. During our review, Coast Guard officials
cited their efforts in one Caribbean Basin country as an example of
how the Coast Guard works with foreign governments to increase
protective measures at their ports. In that case, the Coast Guard
initially found that ports in the country were not substantially
implementing the ISPS Code. After several rounds of sharing
information on security training, discussions of best practices for
security exercises, and suggestions for specific physical security
improvements, the Coast Guard found that the country had made
substantial progress toward implementing the ISPS Code.
In regards to national sovereignty concerns, the Coast Guard is aware
of such concerns and has considered ways to address them. The Coast
Guard has stated that because of sovereignty concerns and "assessment
fatigue," it is becoming increasingly difficult to gain access to
countries such as China, Egypt, India, Libya, Russia, and Venezuela
for reassessments. During our review, Coast Guard officials stated
that an effort was underway to conduct joint visits when possible with
other U.S. government agencies as well as increase the sharing of
assessment data among various agencies to reduce the "footprint" of
U.S. government activities in the countries. As another approach,
Coast Guard officials stated that they have also considered partnering
with other foreign governments and international organizations to
complete assessments. However, the Coast Guard has not partnered with
any international governments to conduct reassessments because the
international community has not developed an approach or methodology
as the Coast Guard has for inspecting ports. The Coast Guard has also
reported that it works frequently with international organizations
such as the Asia Pacific Economic Cooperation (APEC) and the
Organization of American States on capacity-building projects and
utilizes the information obtained when conducting such actions as part
of the assessment process. For example, as part of APEC's
Transportation Working Group's maritime expert group security
subcommittee, the Coast Guard assisted in creating the Port Security
Visit Program and has participated in several of the assessment visits
to member economies. In addition, the Coast Guard has conducted joint
visits with auditors from the Secretariat of the Pacific Community in
Pacific island nations. In the short term, program officials stated
that the best way to mitigate a possible lack of cooperation from
sovereign nations is to continue to reach out and diplomatically work
with countries. The recently enacted Coast Guard Authorization Act of
2010 now mandates that unless the Coast Guard finds that a port in a
foreign country maintains effective antiterrorism measures, that the
Coast Guard notify appropriate governmental authorities of the foreign
country and allows the imposition of conditions of entry (requiring
vessels to take additional security measures) "unless the Coast Guard
finds effective anti-terrorism measures in place in foreign ports." In
cases where countries still deny the Coast Guard access to their
ports, program officials will implement and utilize these provisions
as required and work with other Coast Guard programs in the domestic
arena--specifically, programs that examine foreign vessels to verify
their compliance with ISPS Code requirement--and conduct offshore
security boardings of vessels to help limit the access of high-risk
vessels to U.S. ports.
Port Security Grant Program:
Question from Senator Lautenberg:
7. The Port Authority of New York and New Jersey is unable to move
forward on a number of projects to improve the security of the port
because of the twenty-five percent cost share requirement for port
security grants. It is my understanding that waiving this requirement
is a long, arduous process that is rarely successful. What should be
done about this cost-share requirement so that it does not impede the
security of our ports?
Matching contributions--also known as cost-share requirements--are a
key factor for effective federal grants for two reasons. First, it is
important that federal dollars are leveraged to ensure that federal
grants supplement stakeholder (whether public or private) spending
rather than serve as a substitute for stakeholder spending on grant-
funded projects. If a grant program is not designed to encourage
supplementation, other stakeholders may rely solely on federal funds
and choose to use their own funds for other purposes, meaning that
federal funds cannot be leveraged to the extent they otherwise could
be. We reported in September 2003 that the inclusion of matching
requirements is one method through which to encourage supplementation
of federal grants.[Footnote 14] Second, matching requirements are
reasonable given that grant benefits can be highly localized. For
example, regarding port security grants, we reported in December 2005
that,
"Ports can produce benefits that are public in nature (such as general
economic well-being) and distinctly private in nature (such as
generating profits for a particular company). The public benefits they
produce can also be distinctly local in nature, such as sustaining a
high level of economic activity in a particular state or metropolitan
area. Thus, state and local governments, like private companies, also
have a vested interest in ensuring that their ports can act as
efficient conduits of trade and economic activity. Given that homeland
security threats can imperil this activity, it can be argued that all
of these stakeholders should invest in the continued stability of the
port."[Footnote 15]
However, in the December 2005 report, we also recognized the
differences of opinion among policymakers regarding the inclusion of
matching requirements in federal grants. Some might see substitution
of federal funds for local funds as reasonable given differences in
fiscal capacity, while others may view homeland security as a shared
responsibility. For policymakers who place greater value on reducing
the substitution of federal funds for local funds, strengthening
matching requirements offers one option in administering grants. One
way to implement this requirement involves using a sliding scale for
matching federal funds depending on the fiscal capacity of the grant
applicant. Additionally, the matching requirement under the fiscal
year 2009 Port Security Grant Program (PSGP) stated that the match may
be in the form of cash or in-kind contributions, allowing grant
recipients flexibility in meeting this requirement. However, the cost-
share requirement was waived for fiscal year 2010 port security grants.
Aside from matching requirements, there are other key factors to
consider in ensuring an effective grant process, such as efficiency,
timeliness, and oversight. For example, the DHS Office of Inspector
General reported in March 2010 that DHS has a variety of preparedness
grant programs with similar purposes, redundant application processes,
and differing program requirements.[Footnote 16] In our June 2009
report on the Transit Security Grant Program (TSGP), we identified
problems with grant management and made recommendations related to
defining agency roles when more than one agency is involved in the
grant program, developing a plan for measuring effectiveness,
developing a process to systematically collect data and track grant
activities, and communicating the availability of grant funding to
transit agencies.[Footnote 17]Lacking these grant management
characteristics, the TSGP experienced delays in approving projects and
making funds available. As a result, about $21 million of the $755
million in awarded funds for fiscal years 2006 through 2008 had been
expended by transit agencies. At the request of Ranking Member Peter
T. King of the House Committee on Homeland Security, and Senator
George V. Voinovich of the Senate Committee on Homeland Security and
Governmental Affairs, this month we are initiating a review of grant
management processes of selected DHS preparedness grant programs.
Question from Senator Hutchison:
8. Various ports across the nation have indicated that the port
security grant process is confusing, and that the distribution of
funds is very slow, with FEMA and the USCG still working on delivering
funds from 2007. What insights can GAO offer for a better, and more
efficient, way to distribute port security grants, so that our
nation's ports receive funds in a timely manner? GAO has made a number
of recommendations to TSA and FEMA to improve the grant process for
rail and transit security grants. Do any of those recommendations
apply to port security grants? Is the Fiduciary Agent process an
effective way to distribute port security grant funds?
While we have not reviewed issues related to the distribution of
funding under the PSGP since 2005, and thus cannot offer solutions to
current PSGP problems, we reported in our June 2009 report on the TSGP
that defining agency roles, tracking grant activity, and distributing
funds in a timely manner are important principles of grant management.
[Footnote 18] For example, given that the Federal Emergency Management
Agency (FEMA) and Transportation Security Agency (TSA) share
responsibility for the TSGP, we recommended that the two agencies
define their respective roles and responsibilities for managing the
TSGP. Similarly, FEMA and the Coast Guard should define their
respective roles and responsibilities for managing the PSGP. We also
reported that the systematic collection and tracking of grant
activities under the TSGP is essential to effective grant management.
At FEMA, the Grants Program Directorate (GPD)--which also oversees the
PSGP--is responsible for this record keeping. However, GPD officials
reported in March 2010 that the development of an updated grant
management system--scheduled for completion in 2011--had been halted
because of budget cuts. Lastly, because of delays that transit
agencies experienced in receiving funding, we recommended that TSGP
grant management officials establish time frames for making funds
available to stakeholders that have had projects approved.
Establishing such time frames could help grantees implement projects
within the designated performance periods of the grants.
In addition to negotiating, tracking, and distributing funds, the
process must also include key internal controls. In its Guide to
Opportunities for Improving Grant Accountability, the Domestic Working
Group reported that internal controls are needed to ensure that funds
are properly used and achieve intended results.[Footnote 19] It cites
four areas where internal controls are important: (1) preparing
policies and procedures before issuing grants, (2) consolidating
information systems to assist in managing grants, (3) providing grant
management training to staff and grantees, and (4) coordinating
programs with similar goals and purposes. Establishing effective
internal controls may slow the distribution of grants, as these
systems should be in place prior to the grant award. However, the
Domestic Working Group reported that inadequate internal controls make
it difficult for grant managers to determine whether funds are
properly used.
In terms of using a fiduciary agent, until fiscal year 2009, TSGP
grant funding was first processed through a state administrative
agency (SAA). However, the DHS appropriations acts for fiscal years
2009 and 2010 required funding to be provided directly to transit
agencies.[Footnote 20] We expect to follow up with transit agencies to
identify the impacts of this change and determine whether the removal
of the fiduciary agent added any efficiencies to the grant process as
part of our upcoming review of grant management processes of selected
DHS preparedness grant programs, requested by Ranking Member Peter T.
King of the House Committee on Homeland Security, and Senator George
V. Voinovich of the Senate Committee on Homeland Security and
Governmental Affairs.
Transportation Worker Identification Credential:
Question from Senator Lautenberg:
9. Over a million maritime workers have gone through background checks
and obtained TWIC cards, to gain access to secure areas of our ports.
The Port Authority of New York/New Jersey is one of the sites testing
these TWIC cards. However, this technology has been fraught with
challenges and has not been working as intended. How do the challenges
with the TWIC program affect the security of our ports?
In November 2009, we identified several Transportation Worker
Identification Credential (TWIC) program challenges.[Footnote 21] As
noted in the report, the TWIC pilot is currently under way to test the
use of TWIC cards with biometric card readers. Specifically, this
pilot is intended to test the technology, business processes, and
operational impacts of deploying TWIC readers at secure areas of the
marine transportation system. As such, the pilot is expected to test
the viability of selected biometric card readers for use in reading
TWIC cards within the maritime environment. It is also to test the
technical aspects of connecting TWIC readers to access control
systems. After the pilot has concluded, the results of the pilot are
expected to inform the development of the card reader rule requiring
the deployment of TWIC readers for use in controlling unescorted
access to the secure areas of Maritime Transportation Security Act of
2002 (MTSA)--regulated vessels and facilities.[Footnote 22] However,
as noted in our November 2009 report, shortfalls in TWIC pilot
planning have hindered the TSA and the Coast Guard's efforts to ensure
that the pilot is broadly representative of deployment conditions and
will yield the information needed--such as information on the
operational impacts of deploying biometric card readers and their
costs--to accurately inform Congress and the card reader rule. For
instance, because of schedule constraints, TSA did not conduct its
more rigorous laboratory testing of readers to be used at pilot sites
prior to testing them at pilot sites as initially planned.
Since we issued our report in November 2009, TSA has received the
results of the more rigorous laboratory-based reader durability
testing. However, TSA has not shared the information on reader results
with pilot participants. According to representatives of four of the
seven pilot participants we met with, not sharing the results of
reader testing has limited their ability to acquire the equipment that
meets the environmental and durability needs of their port facilities
and vessels and has resulted in their expending important port
security funds without any assurance that their investment will be
fruitful. Further, not all the approaches proposed in the Advanced
Notice of Proposed Rule Making for using TWIC cards with readers will
utilize the electronic security features on the TWIC card to confirm
that the TWIC card is valid and authentic.
We are currently conducting a review of the TWIC program's internal
controls related to enrollment, background checks, card production,
card activation and issuance, and use. The results of this work,
including related covert testing at port facilities, will be published
in February 2011.
Question from Senator Nelson:
10. Mr. Caldwell, does TSA share the information it gathers in its
background investigations for Transportation Worker Identification
Cards with state law enforcement entities?
TSA reports that it does not share the information that it gathers
during the background investigations of TWIC applicants with state and
local law enforcement entities on a routine basis. Pursuant to MTSA
provisions restricting the use of applicant information and the TWIC
Privacy Impact Assessment, TSA and the Coast Guard limit their sharing
of information on applicants and card holders. MTSA also provides,
however, that such information may be shared with other federal law
enforcement agencies. According to TSA officials, on a case-by-case
basis, TSA can decide to share information if TSA determines that
there is an imminent threat (terrorist or criminal) of loss of life or
property. According to TSA officials, in such a situation, TSA would
provide only basic information, such as the type of threat, location,
and individuals involved, but would likely not provide other
information from a person's TWIC application. Additionally, state and
local law enforcement entities may contact TSA if they identify
criminal use of a TWIC card (e.g., a TWIC card used in commission of a
crime, or presentation of a fraudulent TWIC card for entry into the
secure area of a MTSA-regulated facility) or to verify the
authenticity of a TWIC card.
Additionally, the Coast Guard and TSA have processes in place to share
threat information with other federal law enforcement or terrorism
centers. In the event that a TWIC applicant or TWIC cardholder is
determined to pose a security threat, Coast Guard and TSA have
developed a protocol to ensure effective interagency coordination and
timely action to minimize the potential threat and risk to the
maritime community associated with these individuals.
Supply Chain Security:
Questions from Chairman Rockefeller:
11. Has GAO's work made a formal determination of whether the 100
percent scanning requirement is consistent with risk management?
The application of risk management for container security can be
considered at the strategic level (e.g., assessing risks to the entire
supply chain and designing appropriate security programs) or the
tactical level (e.g., assessing risks to individual containers and
applying extra scrutiny through existing layered security programs).
At the strategic level, federal law and presidential directives call
for the use of risk management in homeland security as a way to
protect the nation against possible terrorist attacks, and CBP uses
risk management in its processes for mitigating potential threats
posed by U.S.-bound cargo containers. Risk management generally calls
for establishing risk management priorities and allocating limited
resources to those assets that face the highest risk. Risk management
is necessary in the context of container security because CBP, like
other DHS components, cannot afford to protect all commerce against
all possible threats. According to risk management frameworks
developed by GAO and DHS, key phases of risk management should include
(1) assessing the risk posed by terrorists' use of cargo containers
and (2) evaluating alternative measures to counter that risk based on
factors such as the degree of risk reduction they afford and the cost
and difficulty to implement them.[Footnote 23] This process includes a
cost-benefit analysis of countermeasure options, which is useful in
evaluating alternatives because it links the benefits from risk-
reducing countermeasures to the costs associated with them. While we
have not conducted an assessment of whether the 100 percent scanning
requirement is consistent with risk management, our prior work
indicates that 100 percent scanning is not consistent because this
strategic analytic process did not occur. Specifically, our work has
shown that DHS has not evaluated the cost-effectiveness of 100 percent
scanning as a countermeasure as part of a risk management framework
for cargo container security.[Footnote 24]
At the tactical level, opponents of 100 percent scanning have taken
the position that it is better to assess the risk posed by each
container and apply a countermeasure that is tailored to that
container--as opposed to assessing the risk posed to supply chain
security by cargo containers in general and then determining the most
cost-effective countermeasure to reduce that risk (e.g., 100 percent
scanning, CBP's layered security approach, or another alternative).
From this perspective, the 100 percent scanning requirement is a
departure from existing CBP container security programs because it
requires CBP to scan all containers before performing analysis to
determine their potential risk level. This position applies risk
management principles--establishing strategic goals and priorities and
allocating limited resources to those assets that face the highest
risk--at the individual container level. According to this view, the
100 percent scanning requirement is inconsistent with risk management
principles because it does not distinguish among containers based on
risk; rather, it assumes that all containers have an equal risk of
carrying terrorist weapons and are to be subjected to the same level
of scrutiny with the same amount of resources. Thus, resources are
applied uniformly across all cargo containers rather than being
allocated based on the potential risk they pose. Opponents of 100
percent scanning who have generally taken this position include CBP,
foreign governments, and industry. For example, the former Acting
Commissioner and current Commissioner of CBP have said that the 100
percent scanning requirement is not a risk-based approach. Similarly,
foreign governments have expressed the view that 100 percent scanning
is not consistent with risk management principles as contained in the
World Customs Organization (WCO) Framework of Standards to Secure and
Facilitate Global Trade (commonly referred to as the SAFE Framework).
For example, European and Asian customs officials told us that the 100
percent scanning requirement is in contrast to the risk-based
strategy, that serves as the basis for other U.S. programs, such as
the Container Security Initiative (CSI)[Footnote 25] and the Customs-
Trade Partnership Against Terrorism (C-TPAT).[Footnote 26] The WCO,
representing customs agencies around the world, stated that the
implementation of 100 percent scanning would be "tantamount to
abandonment of risk management." In terms of industry, in 2008 the
Association of German Seaport Operators released a position paper that
stated that implementing the 100 percent scanning requirement would
undermine mutual, already achieved security successes and deprive
resources from areas that present a more significant threat and
warrant closer scrutiny. Closer to home, the Commercial Operations
Advisory Committee--an official industry group to CBP--has recently
called for the repeal of the 100 percent scanning requirement and a
move toward a more risk-based approach.[Footnote 27]
Still at the tactical level, supporters of 100 percent scanning have
expressed concerns about the effectiveness of existing CBP programs
that attempt to assess the risks of individual containers and subject
those deemed higher risk to closer scrutiny, including non-intrusive
inspection (NII) scanning. Members of Congress who spoke in favor of
the 100 percent scanning requirement noted that scanning all
containers overseas could help detect weapons of mass destruction
concealed in containers that are not identified as high risk because
of weaknesses in CBP's layered security strategy. That is, 100 percent
scanning would be a more effective way to counter the risks posed to
cargo containers than existing initiatives intended to identify high-
risk containers. In making these arguments, certain members of
Congress also cited GAO work that had identified potential weaknesses
in programs that make up the layered security strategy. Our work
identified weaknesses including a lack of validation of CBP's
targeting practices through strategies like red-teaming; inadequate
validation of C-TPAT members' security practices prior to granting
them program benefits, such as a decreased likelihood of having their
shipments scanned or physically examined; and not ensuring that
containers identified as high risk but not scanned at CSI ports
overseas are scanned upon arrival in the United States.[Footnote 28]
The concerns we raised were open issues at the time Congress
considered the 100 percent scanning requirement; however, since that
time, these CBP programs have matured, and many of our recommendations
have been implemented.[Footnote 29]
As mentioned above, risk management includes not just assessing risks,
but also evaluating alternative measures based on such factors as the
degree of risk reduction they afford and the cost and difficulty to
implement them. Our work has documented that there are operational
challenges--such as logistics, technology, and infrastructure--to
implementing 100 percent scanning.[Footnote 30] However, CBP has not
done a detailed analysis to determine the feasibility of 100 percent
scanning within the context of its risk-based layered security
strategy. In this case, part of evaluating alternative measures is
determining a concept of operations--a description of the operations
that must be performed, who must perform them, and where and how the
operations will be carried out--for how 100 percent scanning would
work at foreign ports, which would include conducting studies and
analyses at each port to determine locations where NII equipment would
be able to scan 100 percent of containers going to the United States
with a minimum of disruption to the flow of commerce at the port. For
instance, transshipment--cargo containers from one port that are taken
off a vessel at another port to be placed on another vessel bound for
the United States--poses a particular challenge to 100 percent
scanning. According to European customs officials, implementing the
100 percent scanning requirement at large ports with complex
operations would likely result in the need for a fundamental redesign
of several ports, entailing substantial costs to terminal users. For
other scanning options, the costs may not be as great. For example, as
we describe in more detail in the next section, scanning with only
radiation portal monitors (RPM) is less costly in terms of both
equipment and impact on the flow of commerce.
No homeland security program can guarantee complete success or freedom
from risk, and CBP officials have acknowledged that they will likely
not be able to achieve 100 percent scanning of U.S.-bound cargo
containers by the statutory deadline.[Footnote 31] However, we believe
additional analysis, done within a risk management framework, can help
improve container security. In our October 2009 report on the Secure
Freight Initiative (SFI) and 100 percent scanning, we recommended that
among other things, CBP perform feasibility and cost-benefit analyses
to (1) better position itself to determine the most effective way
forward to enhance container security, (2) improve its container
security programs, and (3) better inform Congress. DHS agreed in part
with our recommendation that it develop a cost-benefit analysis of 100
percent scanning, acknowledging that the recommended analyses would
better inform Congress, but stated that the recommendation should be
directed to the Congressional Budget Office. While the Congressional
Budget Office does prepare cost estimates for pending legislation, we
think the recommendation is appropriately directed to CBP. Given its
daily interaction with foreign customs services and its direct
knowledge of port operations, CBP is in a better position to conduct
any cost-benefit analysis and bring results to Congress for
consideration. We believe that such analyses could help to guide DHS,
CBP, and Congress in their efforts to either implement the 100 percent
scanning requirement or assess other approaches to enhancing container
security.
12. S. 3639 makes a technical amendment so that all U.S.-bound
containers be scanned with either RPM or NII, but not both. It also
extends the deadline for the requirement by three years from 2012 to
2015. What are the advantages of this approach to 100 percent scanning?
Based on our review of the 100 percent scanning requirement, scanning
containers with RPMs instead of in combination with NII equipment may
be more achievable from a technology, logistics, political, and cost
standpoint.[Footnote 32] However, there are limitations to relying
solely on RPMs for scanning cargo containers that should be taken into
consideration.
* Technology/logistics: Scanning containers with RPM equipment is
generally less time-consuming than scanning with NII equipment. While
the actual NII scanning time per container can take as little as 20
seconds, depending on the system, the entire inspection time can take
longer than 6 minutes. As part of the scanning process, customs
officers need time to (1) stage the container to align it properly
between the system's radiation source and detector array, (2) verify
the container information with the manifest, (3) ensure that the
system is set to receive scanned images, (4) interpret the scanned
images and verify them using manifest information, (5) identify and
document any anomalies, (6) save the scanned images, (7) check the
integrity of the seal and verify the seal number, and (8) prepare the
system for the next container. While scanning cargo containers with
NII equipment involves several steps, in contrast it takes the driver
of a standard tractor trailer from 4 to 7 seconds to pass through a
RPM.[Footnote 33]
* Political: Although 173 members of the WCO expressed their
opposition to the 100 percent scanning requirement, in a letter to
members of Congress in September 2008, the WCO noted that it did not
object to the requirement that all cargo containers be subjected to
radiation detection processes (i.e., RPM scanning) prior to shipment
to the United States. In addition, foreign government officials we
spoke with stated that they are generally not opposed to the use of
radiation detection equipment--such as the RPMs that are used as part
of the Megaports Initiative[Footnote 34]--but they are opposed to the
use of NII equipment because of the likelihood that it may hinder
trade and reduce security by consuming a large amount of scarce
resources (i.e., key dock space and increased time needed for cargo
container inspections) for comparatively little benefit.
* Cost: RPM equipment is less expensive than NII equipment. The price
for polyvinyl toluene monitors--the type of RPMs most commonly used at
U.S. seaports--is $425,000 per unit (including deployment costs). In
contrast, the purchase price for large-scale NII systems used by CBP
at U.S. seaports is approximately $3 million per system (including
deployment costs).
* Limitations of RPMs: Scanning containers with RPMs alone introduces
the vulnerability of not detecting shielded nuclear material. However,
if customs officials believe based on targeting data that further
inspections are necessary, they can have a container scanned by NII
equipment.
In addition to the factors listed above, the Department of Energy's
National Nuclear Security Administration (NNSA) has a goal through the
Megaports Initiative of scanning as much global cargo container
traffic as possible with RPMs. Since the start of the Megaports
Initiative in fiscal year 2003, NNSA has completed installations of
RPM equipment at 27 foreign ports, and implementation is under way at
an additional 16 foreign ports. The Megaports Initiative seeks to
equip 100 ports with radiation detection systems by 2015, scanning
approximately 50 percent of global maritime containerized cargo.
13. DHS and CBP have cited the Strategic Trade Corridor and the
Importer Security Filing (10+2) as alternative ways to enhance supply
chain security. They have also stated that new technology for
containers themselves, and the equipment used to scan them, is another
path forward to improve supply chain security. What work does GAO have
on these programs and what is the status of these DHS efforts?
Strategic Trade Corridor Strategy:
The Secretary of Homeland Security has endorsed the concept of a
strategic trade corridor strategy as the path forward for implementing
the SFI program, but DHS and CBP have not yet selected the ports or
funded the expansion of SFI. In particular, in April 2009, the
Secretary of Homeland Security was presented with three options for
implementing the SFI program, ranging from implementing SFI at 70
ports that account for shipping over 90 percent of U.S.-bound
containers to seeking repeal of the 100 percent scanning requirement.
The strategic trade corridor strategy option selected by the Secretary
focuses cargo container scanning efforts on a limited number of ports
where CBP has determined that SFI will help mitigate the greatest risk
of potential weapons of mass destruction entering the United States.
According to CBP's report, Risk-Based, Layered Approach to Supply
Chain Security, sent to Congress in April 2010, the data gathered from
SFI operations will help to inform future deployments to strategic
locations.[Footnote 35] The report further added that CBP plans to
evaluate the usefulness of these deployments and consider whether the
continuation of scanning operations adds value in each of these
locations and in potential additional locations that would
strategically enhance CBP efforts. However, in DHS's Congressional
Budget Justification for FY 2011, CBP requested a decrease in the SFI
program's $19.9 million budget by $16.6 million and did not request
any funds to implement the strategic trade corridor strategy.
According to the budget justification, in fiscal year 2011, SFI
operations will be discontinued at three SFI ports--Puerto Cortes,
Honduras; Southampton, United Kingdom; and Busan, South Korea--and the
SFI program is to be established at the Port of Karachi, Pakistan. We
issued a report in October 2009 that provides further details about
the implementation of the SFI program.[Footnote 36]
Importer Security Filing Program:
While CBP has implemented the Importer Security Filing and Additional
Carrier Requirements,[Footnote 37] collectively known as the 10+2
rule, and is using the information to identify high-risk unmanifested
containers, CBP has not yet fully incorporated the collected data into
its targeting process. In January 2009, CBP implemented the 10+2 rule,
which mandates that importers and vessel carriers submit additional
cargo information, such as country of origin, to CBP before the cargo
is loaded onto a U.S.-bound vessel.[Footnote 38] Collection of the
additional cargo information (10 data elements for importers and 2
data elements for vessel carriers) and their incorporation into CBP's
Automated Targeting System (ATS)[Footnote 39] are intended to enhance
CBP's ability to identify high-risk shipments and prevent the
transportation of potential terrorist weapons into the United States
via cargo containers. CBP has assessed the submitted 10+2 data
elements for risk factors, and according to CBP officials, access to
information on stow plans[Footnote 40] has enabled CBP to identify
more than 1,000 unmanifested containers--containers that are
inherently high risk because their contents are not listed on a ship's
manifest. However, although CBP has conducted a preliminary analysis
that indicates that the collection of the additional 10+2 data
elements could help determine risk earlier in the supply chain, CBP
has not yet finalized its national security targeting weight set for
identifying high-risk cargo containers or established project time
frames and milestones--best practices in project management--for doing
so. We recommended that CBP establish milestones and time frames for
updating its national security weight set to use 10+2 data in its
identification of shipments that could pose a threat to national
security. DHS concurred with this recommendation and said it plans to
complete its updates to the national security weight set by November
2010. More information on the results of our review can be found in
our September 2010 report.[Footnote 41]
Container Security Technologies:
DHS is testing and evaluating technologies for detecting and reporting
intrusions into and tracking the location of cargo containers as they
pass through the global supply chain, but it will take time before the
evaluations are complete and the technology and implementation
challenges are overcome for some of these technologies. In particular,
CBP has partnered with DHS's Science and Technology Directorate (S&T)
to develop performance standards--requirements that must be met by
products to ensure that they will function as intended--for four
container security technologies with the goal of having the ability to
detect and report intrusion into, and track the movement of cargo
containers through the global supply chain. If S&T is able to
demonstrate through testing and evaluation that container security
technologies exist that can meet CBP's requirements, then it plans to
provide performance standards to CBP and DHS's Office of Policy
Development to pursue for implementation. From 2004 through 2009, S&T
spent over $60 million and made varying levels of progress on its four
container security technology projects. Each of these projects has
undergone laboratory testing, but S&T has not yet conducted
operational environment testing to ensure that the prototypes will
satisfy the requirements so that S&T can provide performance standards
to the Office of Policy Development and CBP. Performance standards are
expected to be completed for two of the technologies by the end of
2010, but it could take time before they are complete for the other
two technologies. More information on the results of our review of
container security technologies may be found in our September 2010
report.[Footnote 42]
Cargo Advanced Automated Radiography System:
We also reviewed DHS efforts to improve NII scanning through the cargo
advanced automated radiography system (CAARS) program. DHS intended
for CAARS to be used by CBP to automatically detect and identify
highly shielded nuclear material in vehicles and cargo containers at
U.S. ports of entry. However, DHS's Domestic Nuclear Detection Office
(DNDO) pursued the acquisition and deployment of CAARS machines
without fully understanding that they would not fit within existing
primary inspection lanes at CBP ports of entry. This occurred because
during the first year or more of the program DNDO and CBP had few
discussions about operating requirements at ports of entry. Further,
the development of the CAARS algorithms (software)--a key part of the
machine needed to identify shielded nuclear materials automatically--
did not mature at a rapid enough pace to warrant acquisition and
deployment. These factors contributed to DNDO's December 2007 decision
to make a "course correction" in the program resulting in cancellation
of the acquisition and deployment plans for CAARS. Through this
action, DNDO significantly reduced the scope of CAARS to a research
and development effort designed to demonstrate the potential
capability of the technology. While the development of CAARS-type or
other advanced radiography equipment capable of automatic detection of
highly shielded nuclear material in cargo containers has been ongoing
since 2005, one senior CBP official acknowledged that it is not known
when the technology will be sufficiently mature for agencies within
DHS, such as CBP, to justify acquiring and deploying it in large
numbers. On September 30, 2010, the Director of DNDO announced that
DNDO is terminating the CAARS program. However, the technology
developed under the CAARS program may be utilized by other programs.
More information on the results of our review of CAARS may be found in
our September 2010 statement for the record for the Senate Committee
on Homeland Security and Governmental Affairs.[Footnote 43]
[End of section]
Enclosure 2: GAO Contact and Staff Acknowledgments:
GAO Contact:
Stephen L. Caldwell, (202) 512-9610, or caldwells@gao.gov:
Staff Acknowledgments:
In addition to the contact named above, Dawn Hoff, Assistant Director;
Jonathan Bachman; Chuck Bausell; Lisa Canini; Christopher Conrad;
Frances Cook; Tracey Cross; Alana Finley; Geoff Hamilton; Christine
Hanson; Mike Harmond; Christopher Hatscher; Dawn Hoff; Richard Hung;
Tracey King; Daniel Klabunde; Lara Miklozek; Julie Silvers; and Katy
Trenholme were key contributors to this letter.
[End of section]
Footnotes:
[1] GAO, Maritime Security: DHS Progress and Challenges in Key Areas
of Port Security, [hyperlink,
http://www.gao.gov/products/GAO-10-940T], (Washington, D.C.: July 21,
2010).
[2] GAO, Maritime Security: Varied Actions Taken to Enhance Cruise
Ship Security, but Some Concerns Remain, [hyperlink,
http://www.gao.gov/products/GAO-10-400], (Washington, D.C.: Apr. 9,
2010).
[3] The goals of DHS's Small Vessel Security Strategy are consistent
with the critical infrastructure protection maritime sub-sector goal
to enhance the resiliency of the maritime transportation system.
According to the strategy, reducing the risk from small vessels will
contribute to the security of our ports and help prevent the
disruption of commerce and the negative impact of a vessel security
incident by reducing the potential consequences of such an incident.
The primary consequence of a terrorist incident (as well as other
transportation security incidents) arising from the use of a small
vessel could be devastating for the U.S. economy if it damaged
critical infrastructure or resulted in closure of a port. By reducing
the risk and the associated consequences from small-vessel risks, the
strategy contributes to the resilience of the maritime sector and
associated critical infrastructure.
[4] As we reported in March of 2009, some cameras have the ability to
operate in low light or use infrared images that distinguish objects
by the heat they emanate. These capabilities allow them to be
effective when cameras using visible light prove ineffective, such as
at night or in bad weather. However, these cameras can still be
affected by high surf conditions, which can hide vessels smaller than
the height of the waves. For additional information, see GAO, Maritime
Security: Vessel Tracking Systems Provide Key Information, but the
Need for Duplicate Data Should Be Reviewed, GAO-09-337 (Washington,
D.C.: Mar. 17, 2009).
[5] AIS is a technology that uses global navigation satellite data and
radios to transmit and receive information about a vessel's voyage,
including its name, position, course, and speed.
[6] Our April 2008 report is restricted and not available to the
public.
[7] GAO, Supply Chain Security: CBP Works with International Entities
to Promote Global Customs Security Standard and Initiatives, but
Challenges Remain, [hyperlink, http://www.gao.gov/products/GAO-08-538]
(Washington, D.C.: Aug. 15, 2008).
[8] Pub. L. No. 111-281, ___ Stat. ___ (2010).
[9] Pub. L. No. 109-347, 120 Stat. 1884, 1918 (2006).
[10] H.R. Conf. Rep. No. 109-699, at 142 (2006).
[11] Our April 2008 report is restricted and not available to the
public.
[12] GAO, Coast Guard: Service Has Taken Steps to Address Historic
Personnel Problems, but It Is too Soon to Assess the Impact of These
Efforts, [hyperlink, http://www.gao.gov/products/GAO-10-268R],
(Washington, D.C.: Jan. 29, 2010).
[13] While the focus of the program is country based, the
implementation status of specific ports or port facilities is
considered on a case-by-case basis if the country has not
substantially implemented the ISPS Code. In certain cases, a port
facility that has implemented the ISPS Code in a country that has not
may request that it be considered separately from the country.
Requests are handled on a case-by-case basis and are generally limited
to only those port facilities critical to maritime trade with the
United States based on factors such as the volume and importance of
the cargo imported from or exported to that port or port facility.
[14] GAO, Homeland Security: Reforming Federal Grants to Better Meet
Outstanding Needs, [hyperlink,
http://www.gao.gov/products/GAO-03-1146T] (Washington, D.C.: Sept. 3,
2003).
[15] GAO, Risk Management: Further Refinements Needed to Assess Risks
and Prioritize Protective Measures at Ports and Other Critical
Infrastructure, [hyperlink, http://www.gao.gov/products/GAO-06-91]
(Washington, D.C.: Dec. 15, 2005).
[16] Department of Homeland Security, Office of Inspector General,
Efficacy of DHS Grant Programs, OIG-10-69 (Washington, D.C., Mar. 22,
2010).
[17] GAO, Transit Security Grant Program: DHS Allocates Grants Based
on Risk, but Its Risk Methodology, Management Controls, and Grant
Oversight Can Be Strengthened, [hyperlink,
http://www.gao.gov/products/GAO-09-491] (Washington, D.C.: June 8,
2009).
[18] [hyperlink, http://www.gao.gov/products/GAO-09-491].
[19] The Domestic Working Group, consisting of 19 federal, state, and
local audit organizations, was formed to identify current and emerging
challenges and explore opportunities for greater collaboration within
the intergovernmental audit community. The group identified grant
accountability as a concern and created a project team to address this
concern. The results are presented in the following report: Domestic
Working Group Grant Accountability Project: Guide to Opportunities for
Improving Grant Accountability (Washington, D.C., October 2005).
[20] Pub. L No. 110-329, 122 Stat. 3574, 3671 (2008); Pub. L. No. 111-
83, 123 Stat. 2142, 2159 (2009).
[21] GAO, Transportation Worker Identification Credential: Progress
Made in Enrolling Workers and Activating Credentials but Evaluation
Plan Needed to Help Inform the Implementation of Card Readers,
[hyperlink, http://www.gao.gov/products/GAO-10-43] (Washington, D.C.:
Nov. 18, 2009).
[22] Pub. L. No. 107-295, 116 Stat. 2064.
[23] [hyperlink, http://www.gao.gov/products/GAO-06-91] and DHS,
National Infrastructure Protection Plan, Partnering to Enhance
Protection and Resiliency (Washington, D.C.: January 2009).
[24] GAO, Supply Chain Security: Feasibility and Cost-Benefit Analysis
Would Assist DHS and Congress in Assessing and Implementing the
Requirement to Scan 100 Percent of U.S.-Bound Containers, [hyperlink,
http://www.gao.gov/products/GAO-10-12] (Washington, D.C.: Oct. 30,
2009).
[25] CBP places staff at participating foreign ports to work with host
country customs officials to target and examine high-risk container
cargo for weapons of mass destruction before they are shipped to the
United States.
[26] Through the C-TPAT program, CBP develops voluntary partnerships
with members of the international trade community comprised of
importers; manufacturers; customs brokers; forwarders; air, sea, and
land carriers; and contract logistics providers. Private companies
agree to improve the security of their supply chains in return for
various benefits, such as reduced examination of their cargo.
[27] The Commercial Operations Advisory Committee advises the
Secretaries of the Treasury and Homeland Security on the commercial
operations of CBP and related DHS and Department of the Treasury
functions.
[28] See for example, GAO, Cargo Security: Partnership Program Grants
Importers Reduced Scrutiny with
Limited Assurance of Improved Security, [hyperlink,
http://www.gao.gov/products/GAO-05-404] (Washington, D.C.: Mar. 11,
2005), and
Homeland Security: Summary of Challenges Faced in Targeting Oceangoing
Cargo Containers for Inspection, [hyperlink,
http://www.gao.gov/products/GAO-04-557T] (Washington, D.C.: Mar. 31,
2004).
[29] We previously reported on the maturing of these programs and the
implementation of our recommendations in GAO, Maritime Security: The
SAFE Port Act: Status and Implementation One Year Later, [hyperlink,
http://www.gao.gov/products/GAO-08-126T] (Washington, D.C.: Oct. 30,
2007).
[30] GAO, Supply Chain Security: Challenges to Scanning 100 Percent of
U.S.-Bound Cargo Containers, [hyperlink,
http://www.gao.gov/products/GAO-08-533T] (Washington, D.C.: June 12,
2008).
[31] The statute provides that containers loaded at foreign ports on
or after July 1, 2012 shall not enter the United States unless they
were scanned by NII equipment and radiation detection equipment prior
to loading. It also provides for renewable, two-year extensions if DHS
certifies to Congress that certain conditions exist at a port or
ports, such as equipment not being available for purchase and
installation, physical constraints, or a significant impact on trade
capacity and flow of cargo. See 6 U.S.C. § 982(b).
[32] [hyperlink, http://www.gao.gov/products/GAO-10-12].
[33] Containers that trigger a radiation alarm at the RPM undergo a
second exam with a handheld radiation detection device to help ensure
that the source of the alarm is identified and resolved. The exam with
the handheld radiation detection device typically requires 5 to 10
minutes to perform.
[34] Through the Megaports Initiative, the Department of Energy
installs radiation detection equipment at key foreign ports, enabling
foreign government personnel to use radiation detection equipment to
scan shipping containers entering and leaving these ports, regardless
of the containers' destination, for nuclear and other radioactive
material that could be used against the United States and its allies.
[35] U.S. Customs and Border Protection, Risk-Based, Layered Approach
Supply Chain Security, Fiscal Year 2010 Report to Congress (Washington
D.C., Apr. 13, 2010).
[36] [hyperlink, http://www.gao.gov/products/GAO-10-12].
[37] Importer Security Filing and Additional Carrier Requirements, 73
Fed. Reg. 71,730 (Nov. 25, 2008) (to be codified at 19 C.F.R. pts. 4,
12, 18, 101, 103, 113, 122, 123, 141, 143, 149, 178, and 192).
[38] Under other requirements that preceded the 10+2 rule, importers
are also required to provide customs entry information, and carriers
are required to provide cargo manifest information under the 24-hour
rule.
[39] ATS is a computer model that CBP uses to analyze shipment data
for risk factors and target potentially high-risk oceangoing cargo
containers for inspection. For more information on ATS, see GAO, Cargo
Container Inspections: Preliminary Observations on the Status of
Efforts to Improve the Automated Targeting System, [hyperlink,
http://www.gao.gov/products/GAO-06-591T] (Washington, D.C.: Mar. 30,
2006), and [hyperlink, http://www.gao.gov/products/GAO-04-557T].
[40] Stow plans depict the position of each cargo container on a
vessel.
[41] GAO, Supply Chain Security: CBP Has Made Progress in Assisting
the Trade Industry in Implementing the New Importer Security Filing
Requirements, but Some Challenges Remain, [hyperlink,
http://www.gao.gov/products/GAO-10-841] (Washington, D.C.: Sept. 10,
2010).
[42] GAO, Supply Chain Security: DHS Should Test and Evaluate
Container Security Technologies Consistent with All Identified
Operational Scenarios to Ensure the Technologies Will Function as
Intended, [hyperlink, http://www.gao.gov/products/GAO-10-877]
(Washington, D.C.: Sept. 29, 2010).
[43] GAO, Combating Nuclear Smuggling: Inadequate Communication and
Oversight Hampered DHS Efforts to Develop an Advanced Radiography
System to Detect Nuclear Materials, [hyperlink,
http://www.gao.gov/products/GAO-10-1041T] (Washington, D.C.: Sept. 15,
2010).
[End of section]
GAO's Mission:
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people.
GAO examines the use of public funds; evaluates federal programs and
policies; and provides analyses, recommendations, and other assistance
to help Congress make informed oversight, policy, and funding
decisions. GAO's commitment to good government is reflected in its core
values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each
weekday, GAO posts newly released reports, testimony, and
correspondence on its Web site. To have GAO e-mail you a list of newly
posted products every afternoon, go to [hyperlink, http://www.gao.gov]
and select "E-mail Updates."
Order by Phone:
The price of each GAO publication reflects GAO‘s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAO‘s Web site,
[hyperlink, http://www.gao.gov/ordering.htm].
Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.
Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional
information.
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]:
E-mail: fraudnet@gao.gov:
Automated answering system: (800) 424-5454 or (202) 512-7470:
Congressional Relations:
Ralph Dawn, Managing Director, dawnr@gao.gov:
(202) 512-4400:
U.S. Government Accountability Office:
441 G Street NW, Room 7125:
Washington, D.C. 20548:
Public Affairs:
Chuck Young, Managing Director, youngc1@gao.gov:
(202) 512-4800:
U.S. Government Accountability Office:
441 G Street NW, Room 7149:
Washington, D.C. 20548:
